fabioaduarte
(usa Ubuntu)
Enviado em 30/12/2009 - 09:07h
Vlw ai pelo interesse, segue abaixo os confs
------------
squid.conf
http_port 3128
visible_hostname HOSTNAME
# Config Cache
cache_mem 64 MB
maximum_object_size_in_memory 128 KB
maximum_object_size 512 MB
minimum_object_size 2 KB
cache_swap_low 90
cache_swap_high 95
cache_dir ufs /csquid 7168 16 256
cache_access_log /var/log/squid/access.log
refresh_pattern ^ftp: 15 20% 2280
refresh_pattern ^gopher: 15 0% 2280
refresh_pattern . 15 20% 2280
error_directory /usr/share/squid/errors/Portuguese
# ACLs padrao
acl all src XXX.XXX.XXX.XXX/XX #REDELOCAL
acl redelocal src XXX.XXX.XXX.XXX/XX #REDELOCAL
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 407 # MSN
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 901 # swat
acl Safe_ports port 1025-65535 # portas altas
acl purge method PURGE
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access allow purge localhost
http_access deny purge
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
#redirect_program /usr/bin/squidGuard
#redirector_bypass on
http_access deny !redelocal
auth_param basic program /usr/lib/squid/ncsa_auth /etc/squid/squid_passwd
auth_param basic children 5
auth_param basic realm Servidor de Internet
auth_param basic credentialsttl 1 hours
acl autenticados proxy_auth REQUIRED
http_access allow autenticados
http_access allow localhost
http_access deny all
-----------------
script firewall
#!/bin/bash
firewall_start() {
#Limpando regras do firewalll
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
# Abre para uma faixa de enderecos da rede local
iptables -A INPUT -p tcp --syn -s XXX.XXX.XXX.XXX/XX -j ACCEPT #REDELOCAL
iptables -A OUTPUT -p tcp --syn -s XXX.XXX.XXX.XXX/XX -j ACCEPT #REDELOCAL
# Abre a porta do Squid para a rede local (eth0=INTERFACEINTERNA)
iptables -A INPUT -i eth0 -p tcp --dport 3128 -j ACCEPT
# Limitando acesso a porta do SSH
iptables -A INPUT -p tcp -s XXX.XXX.XXX.XXX/XX --dport 22 -j ACCEPT #REDELOCAL
iptables -A INPUT -i eth1 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
# Ignorando pings
# echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_all
#Protege contra synflood
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
# Desabilita o suporte a source routed packets
# Este recurso funciona como um NAT ao contrario, que em certas circunstancias pode permitir que alguem da internet envie pacotes para PCs dentro da rede local
echo "0" > /proc/sys/net/ipv4/conf/eth0/accept_source_route
echo "0" > /proc/sys/net/ipv4/conf/eth1/accept_source_route
# Protege contra ICMP Broadcasting
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Protecoes diversas contra ping of death
iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
# Protecao contra Syn-floods
iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
# Permiti encaminhar conexoes com status "Estabilizado e Relacionado"
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
# Protecao contra port scanners ocultos
iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
# Protege contra pacotes que podem procurar e obter informacoes da rede interna
iptables -A FORWARD --protocol tcp --tcp-flags ALL SYN,ACK -j DROP
# Protecao contra ataques
iptables -A INPUT -m state --state INVALID -j DROP
iptables -N VALID_CHECK
iptables -A VALID_CHECK -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags ALL ALL -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags ALL FIN -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A VALID_CHECK -p tcp --tcp-flags ALL NONE -j DROP
# Abre para a interface de loopback.
#iptables -A INPUT -p tcp --syn -s 127.0.0.1/255.0.0.0 -j ACCEPT
iptables -A OUTPUT -p tcp --syn -s 127.0.0.1/255.0.0.0 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
# Gerando log de Backdoors
iptables -A INPUT -p tcp --dport 5042 -j LOG --log-prefix "Wincrash"
iptables -A INPUT -p tcp --dport 12345 -j LOG --log-prefix "backOrifice"
iptables -A INPUT -p tcp --dport 12346 -j LOG --log-prefix "backOrifice"
# Bloqueia qualquer conexao que nao tenha sido permitida acima, justamente por isso eh a ultima.
iptables -A INPUT -p tcp --syn -j DROP
#iptables -A OUTPUT -p tcp --syn -j DROP
#iptables -A FORWARD -p tcp --syn -j DROP
# Habilita o mascaramento dos pacotes que saem da rede local para internet
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
# Libera IPs Caixa Economica Federal
iptables -t nat -A PREROUTING -p tcp -d 200.201.0.0/16 -j ACCEPT
iptables -A FORWARD -p tcp -d 200.201.0.0/16 -j ACCEPT
# Redireciona todos pacotes vindos da rede local para o Squid
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
}
firewall_stop() {
iptables -F
iptables -X
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
}
case "$1" in
start)
firewall_start
echo "Iniciando Firewall ..."
sleep 2
echo "Firewall iniciado !"
;;
stop)
firewall_stop
echo "Desativando Firewall ..."
sleep 2
echo "Firewall desativado !"
;;
restart)
echo "Reiniciando Firewall ..."
firewall_start
sleep 3
echo "Firewall reiniciado !"
;;
*)
esac
